CVE-2026-50563

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image. This issue has been patched in version 1.24.0.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-505649.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505654.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505669.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505677.7Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505683.6Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505694.3Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-50577.5ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denia CVE-2026-505708.5Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505725.9Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's CVE-2026-505738.1pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detect CVE-2026-505749.6yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest CVE-2026-505757.7BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allow